CVE-2026-100075

Undergoing Analysis Undergoing Analysis - In Progress

RDMA Context Leak in Linux Kernel srpt Driver

Publication date: 2026-09-25

Last updated on: 2026-10-02

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters When srpt_alloc_rw_ctxs() fails partway through a multi-buffer indirect descriptor, the unwind path destroys RDMA contexts but leaves stale n_rw_ctx and n_rdma values (and a dangling rw_ctxs pointer). Later sq_wr_avail accounting in srpt_queue_response() or srpt_write_pending() can then subtract the wrong number of send queue credits. Reset the counters and clear rw_ctxs after freeing the heap allocation before returning an error.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-02

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-100075

EUVD

EUVD-2026-87055

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 5.11 (inc) to 5.15.221 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.188 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.52 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.2.6 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.157 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.110 (exc)
linux	linux_kernel	From 4.7 (inc) to 5.10.270 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's RDMA subsystem, specifically in the srpt_alloc_rw_ctxs() function. When handling multi-buffer indirect descriptors, if an error occurs during allocation, the cleanup process fails to properly reset counters and pointers. This leaves stale values for n_rw_ctx and n_rdma, and a dangling rw_ctxs pointer. Later operations may then incorrectly calculate send queue credits, potentially leading to system instability or miscalculations.

Detection Guidance

This vulnerability is specific to the Linux kernel's RDMA/srpt subsystem. Detection requires checking kernel logs for errors related to srpt_alloc_rw_ctxs() failures or incorrect send queue credit accounting. Use commands like dmesg | grep srpt or journalctl -k | grep srpt to inspect kernel logs for related errors.

Impact Analysis

This vulnerability could allow an attacker to cause a denial of service or trigger incorrect accounting in the RDMA subsystem. If exploited, it might lead to system crashes, resource exhaustion, or unexpected behavior in applications relying on RDMA for high-performance networking. The high CVSS score indicates significant potential impact.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it pertains to a Linux kernel RDMA subsystem issue. No evidence suggests data breaches or unauthorized access risks that would impact these standards.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. Update your system to a kernel version containing the fix for srpt_alloc_rw_ctxs(). Monitor kernel logs for any signs of exploitation or misconfiguration after patching.

Hi! I’m here to help you understand CVE-2026-100075. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70